11
11 Was the establishment of Privacy and Security Rules for PHI. Privacy- Definition, Use & Disclosure of PHI, Notice of rights, how you handle PHI Security- Definitions, How you secure PHI, physically, technically, organization cares for it and the risk assessment. In summary what is….

12
12 It widen the scope of Privacy and Security Rules It increased legal liability It provides/created more specific enforcement of certain parts of the rule: Breach notification Created the vehicle for state enforcement Created the vehicle for financial penalties Created mandatory penalties for “willful neglect” In summary what is…. HITECH Health Information Technology for Economic and Clinical Health Act

13
13 Objective: Protect electronic health information created or maintained by the certified EHR technology (CEHRT) through the implementation of appropriate technical capabilities. Meaningful Use and Risk Assessment www.IonITGroup.com In summary what is….

21
21 www.IonITGroup.com 1. Minimal Protection: A number of organizations lacked even rudimentary safeguards to protect their networks. 2. Poor Data Management: Many covered entities did not have a handle on where their data ‘lived.’ Some of it was in spreadsheets, some on individual workstations and much of it was—as expected—in core clinical applications 3. Lack of Oversight: Overall, the OCR discovered a general lack of monitoring and audit control. No one was minding the store, and breaches often went undetected. What they found was troubling:

25
25 www.IonITGroup.com How to help your organization with compliance.

26
Accounting for Disclosures Always indicate why treatment, payment, or authorization information is being disclosed. Minimum Necessary Rule: “…take reasonable steps to limit the use or disclosure of, and requests for, [PHI] to the minimum necessary to accomplish the intended purpose.” 26 www.IonITGroup.com

27
Tasks for the IT Dept Role-Based Access: Manage who gets access to what. Firewall Review: Make sure that communication with the outside world is secure. Wireless Security: Manage who gets WiFi access, is it secure. Antivirus: Manage software to keep viruses and malware at bay. Server/Workstation Updates: Make sure all software AND hardware gets appropriate updates to mitigate problems. Replace antiquated non supported hardware whenever possible. 27 www.IonITGroup.com No longer Supported. No security updates.

28
Tasks for the IT Dept Backup: Keep a backup of all data Backup Encryption: Make backup data unreadable to snoopers. Recovery: Have an operation and data recover plan in case disaster strikes! 28 www.IonITGroup.com

29
Tasks for the IT Dept 29 www.IonITGroup.com Heartbleed Open SSL Vulnerability is serious!

30
30 For More information/Additional Resources: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html Penalties and Enforcement http://www.healthit.gov/sites/default/files/pdf/privacy/privacy- and-security-guide.pdf Privacy and Security Guide from ONC http://ocrnotifications.hhs.gov/ Breach Notification/ Who do I notify?

31
31 Thank you for your time today! Robert Morris RMorris@IonITGroup.com 615.351.4796 www.IonITGroup.com